Platform profile, rank 10 of 12, Narrow or undocumented

SentinelOne Purple AI review: policy-bound agents inside Singularity, unpriced on its own

The short answer

SentinelOne Purple AI totals 5.70 and ranks 10 of 12. Automated actions run only within pre-approved policies, each one logged. The 63 and 55 percent figures combine Purple AI with AI SIEM and have no comparison group; the IDC method was not read.

SentinelOne Purple AI alternatives Back to the index

The seven scores

Criterion	Weight	Score	Why
Use-case breadth	20%	6	Investigation, Auto-Triage, natural-language querying and policy-bound response.
Context grounding	15%	5	Reasons over OCSF-normalised data; organisational learning is not described.
Autonomy controls	15%	7	Automated actions run only within pre-approved policies, each one logged.
Published evidence	15%	4	The 63 and 55 percent figures combine Purple AI with AI SIEM and have no comparison group; the IDC method was not read.
Integration transparency	15%	6	Third-party OCSF sources through the Singularity data lake; no count.
Pricing transparency	10%	5	Platform packages are priced (179.99 and 229.99 USD per endpoint per year); Purple AI is not.
Momentum and recognition	10%	7	Singularity ASOC and ADR announced 2026-10-21; its recognition is for endpoint and XDR, not AI SOC.
Weighted total	100%	5.70

What it is

SentinelOne's AI security analyst inside the Singularity Platform: investigations, Auto-Triage, natural-language querying, Investigation Notebooks, and Singularity Hyperautomation that executes responses within pre-approved policies; Singularity ASOC and ADR announced 2026-10-21. (Vendor description, www.sentinelone.com.)

Ownership and funding: SentinelOne, Inc. (publicly listed).

Use cases it documents

As stated by SentinelOne Purple AI: Investigation and summarisation; Auto-Triage; Querying without query writing; Automated response within policy.
Use case	Coverage
SOC triage and investigation	Yes
Threat hunting	No
Incident containment	Yes
Insider risk and DLP	No
Exposure management	No
Detection engineering	No
Security engineering	No

How it learns your environment

Reasons over OCSF-normalised data from SentinelOne and third-party sources.

Autonomy and controls

Automated actions run only within pre-approved policies, each action logged; human-in-the-loop authority referenced in the FAQ.

Integrations and deployment

Third-party OCSF sources through the Singularity data lake; no count on the pages read.

Pricing

Purple AI has no published price; Singularity Complete 179.99 and Commercial 229.99 USD per endpoint per year (5 to 100 workstations) are platform package prices; the page does not say whether Purple AI is included (read 2026-11-03).

Published evidence

Grades from the claims audit. All figures are vendor claims unless the grade says otherwise.
Claim	Method as stated	Grade
Purple AI and AI SIEM cut detection time by 63 percent and remediation time by 55 percent	Combined figure, no sample or comparison group	C
55 percent faster remediation per an IDC Snapshot (April 2025)	IDC sample and method not read	C
YKK Americas saves 40 to 50 percent of investigation time	Customer testimonial	C

Named customers

10 customers named on the vendor's own pages (vendor claim, not verified with the customers): Yahoo, YKK Americas, MBCI, NVIDIA, Cisco, Mastercard, S&P Global, Lockheed Martin, DoorDash, Aramco.

Recognition

Gartner Magic Quadrant for Endpoint Protection Platforms 2026 Leader (endpoint, not AI SOC)
IDC MarketScape Worldwide XDR Software 2025 Leader (XDR, not AI SOC)

What we could not verify

No Purple AI price
No accuracy or triage agreement figure
Changelog not found

Alternatives

CrowdStrike Charlotte AI (profile distance 1.73)
Intezer (profile distance 1.73)
Prophet Security (profile distance 2.24)
Dropzone AI (profile distance 2.83)
Exaforce (profile distance 4.12)

When to switch from SentinelOne Purple AI to each of them.